If you want to disable only local login for normal users you can use the file /etc/security/access.conf for this purpose however it doesn’t work by default even if you configure this file properly. For example, if you want to allow root logins locally but not any other user, edit access.conf file such that;

Literally the above line means ” Disable (-) all users’  (ALL) login access except (EXCEPT) root user (root) and allow root user to login via all terminals.

We haven’t finished yet as we must introduce this file into pam configuration. The necessary pam module is “pam_access” my new /etc/pam.d/login file is as follows:

By the default, the red line isn’t in this file. Once you add it, you will see that access restrictions are applied.

When I install Gentoo, as far as I remember, by default normal users aren’t allowed to use “su” . If you want to let any user to use “su” then you have to add them into the “wheel” user group. In redhat, you can uncomment one line, and it works like a charm.

Edit the file /etc/pam.d/su :

If you uncomment the red line;

Then users have to be in wheel group in order to gain access to root privileges. Once you add your normal user into wheel user e.g

this test users can switch into root user.

Sometimes you need to view certificates with a simple utility rather then using a browser or MUA. Here is how you can do it with openssl. For instance you would like to display the certificate of https://192.168.200.1  , lets do it;

DISPLAYING A REMOTE CERTIFICATE

DISPLAYING A LOCAL CERTIFICATE (FILE)

If you issue the following command for the certificate file (server.crt) locally saved, you will see the certificate details

I was trying to find out how I can add a permanent route into Redhat so that after the reboot routes should persist. I have found the way but I must say that I really didn’t like it:( I liked the way Gentoo does it or Slackware but Redhat’s way seems to be too simplistic but it causes more work. Here is how it works;

It is sufficient to add your routes into the file /etc/sysconfig/network-scripts/route-ethX. Replace X with your interface number. For example;

In /etc/sysconfig/network-scripts/route-eth0, I have added the following routes to make them permanent.

Each time you need another route, you must just increment each variable by one, then route will stay in routing table after the reboot.

You may be asking why we don’t/can’t add the route into rc.local or somewhere else. IMHO, it is best practice to use the tools provided by the distribution so that if another engineer needs to take a look into the system, he will know for sure where to look.

In this article we will configure samba based on a case in which SELinux is enabled again . The case is:

“Setup samba in such a way that only users mert and yigit will be able to access the folder /samba_share in the server”

1) First create the folder and set the permissions for these users and adjust selinux settings.

From the getfacl output we can see that root,mert and yigit users have full access on this folder.

Now put this new share under the security context type of samba which is : samba_share_t

As it can be seen we have also added the folder into the policy so that if relabeling is performed, this folder won’t be affected.

2) Setup SAMBA config to allow access for these users

and reload samba

Note: As we have used “valid users” option for users, no other users are allowed even to display/login into this share. If we had written
“writable = no” and “write list = yigit mert” , then other users would have also gained access into this share.

Continue Reading »

When SELinux and BIND are together, there is not much to say as there are only two booleans that you can toggle as you can see below;

Continue Reading »

SELinux (Security Enhanced Linux) is something that some of us may be afraid of because once it is enabled network services start to behave abnormally. However once it is configured properly you can restrict processes and enforce their access to files and directories as you wish. In this article we will speak briefly about integration of SELinux with Apache.

SELinux modes

There three modes of SELinux

• Enforcing : You can restrict processes in this mode
• Permissive : You can see what might happen in the logs if the mode was Enforcing instead of Permissive.
• Disabled : Inactive state

You can query the runtime mode with “getenforce”:

or you can set the SELinux mode with “setenforce”:

Note: If you want to set the selinux mode to enforcing, you must reboot the server to relabel the filesystem. To have your changes to be persistent between reboots, set the SELinux mode in /etc/sysconfig/selinux file.

Redhat uses targeted policy by default which isn’t very strict and mainly service focused.

Continue Reading »

In our previous article we have configured our systems to authenticate from an NIS server. Now we are using LDAP which is more effective and easy to manage.  Software installation isn’t within the scope of this documentation but pure configuration. Our tests systems are Redhat 5.4 but you can use this in other redhat based systems. Lets start;

Here are the details about our setup once:

LDAP Server: rh54srv1.iptables.gen.tr
Linux client: rh54-2.iptables.gen.tr

[LDAP configuration]

Adjust the following lines in your /etc/openldap/slapd.conf

Start LDAP server:

Send a sample query to our fresh LDAP server to test the queries. Be careful command should be in single line and shouldn’t be wrapped, if so, use backslash.

This is a good answer:) though we haven’t received any records as we don’t have any.

Now we will migrate our current password and group files into LDAP. Get the following scripts for this purpose:

Continue Reading »

This article is about to configure NIS server and NIS client in a redhat base distribution.  I know that NIS isn’t the preferred method of authentication anymore but I wanted to add this short NIS document along with autofs usage so that when any user logs in, their homedirectories at the remote NFS server will be mounted automatically.

Lets start:

Sample NIS domain: penguen.com
NIS Server: rh54srv1.penguen.com
NIS Server IP:  192.168.200.1
NIS Client IP: 192.168.200.81

**Don’t forget that this hostname to IP mapping must exist in /etc/hosts file.

[SERVER SIDE CONFIGURATION]

Install the packages required for NIS server

Add the following line  into cat /etc/sysconfig/network

Start the following daemons

Continue Reading »

Software raid configuration is quite easy and within a few minutes you can start building your array. Depending on the size of the array, build time may vary. Here is a quick instruction about how you can use mdadm utility to create a raid 1 array.

We have two partitions of the size 512MB in two different disks:

First Partition: /dev/sdb2
Second Partition: /dev/sdc1
Partition Types: fd (Linux raid auto detect)

As we are creating a raid paritition, using fdisk set both partition types to the code “fd” . Your output from fdisk will be something like below;

Continue Reading »